Shai-Hulud

Use stolen maintainer credentials to create and publish malicious package artifacts.

If it has a usable GitHub token, it can create a public repository under the victim account ... The npm propagation path activates when the payload finds npm credentials with sufficient publish permissions.

The campaign, which JFrog has dubbed "IronWorm," targets developers through compromised npm publishing workflows and malicious package updates.

TeamPCP specializes in supply-chain attacks against open-source software... The group has claimed responsibility for a spate of supply-chain attacks targeting JavaScript and Python software repositories through wormable malware known as Shai-Hulud.

The malicious behavior comes from abusing command execution inside the `binding.gyp` configuration. Instead of compiling a legitimate native extension, the configuration can execute a malicious JavaScript payload during the package installation process.

an npm install can lead to node, then curl and unzip, and then bun run executing a temporary file.

The delivery chain starts with a single large JavaScript file invoked by node during preinstall. | its package metadata includes a hidden install-time execution path: { "name" : "@redhat-cloud-services/types" , "version" : "3.6.1" , "scripts" : { "preinstall" : "node index.js" } }

Use stolen maintainer credentials to create and publish malicious package artifacts.

If it has a usable GitHub token, it can create a public repository under the victim account ... The npm propagation path activates when the payload finds npm credentials with sufficient publish permissions.

on macOS, it can install com.user.kitty-monitor.plist ... ~/Library/LaunchAgents/com.user.kitty-monitor.plist ... ~/Library/LaunchAgents/com.user.gh-token-monitor.plist

On Linux, it can install a user-level kitty-monitor.service ... Stop and remove kitty-monitor persistence on Linux ... ~/.config/systemd/user/kitty-monitor.service

It can write a local payload copy under ~/.config/index.js and add session-start hooks ... It can also add VS Code folder-open tasks that execute a setup script when a repository is opened.

In GitHub Actions environments, it can use ACTIONS_ID_TOKEN_REQUEST_TOKEN and ACTIONS_ID_TOKEN_REQUEST_URL to request an OIDC token for npm:registry.npmjs.org, exchange it at the npm registry, and publish through the obtained identity.

Use stolen maintainer credentials to create and publish malicious package artifacts.

If it has a usable GitHub token, it can create a public repository under the victim account ... The npm propagation path activates when the payload finds npm credentials with sufficient publish permissions.

on macOS, it can install com.user.kitty-monitor.plist ... ~/Library/LaunchAgents/com.user.kitty-monitor.plist ... ~/Library/LaunchAgents/com.user.gh-token-monitor.plist

On Linux, it can install a user-level kitty-monitor.service ... Stop and remove kitty-monitor persistence on Linux ... ~/.config/systemd/user/kitty-monitor.service

It can write a local payload copy under ~/.config/index.js and add session-start hooks ... It can also add VS Code folder-open tasks that execute a setup script when a repository is opened.

The attack begins with an obfuscated index.js payload that proceeds through decryption and decoding stages and ultimately drops 15 distinct payloads...

Use stolen maintainer credentials to create and publish malicious package artifacts.

If it has a usable GitHub token, it can create a public repository under the victim account ... The npm propagation path activates when the payload finds npm credentials with sufficient publish permissions.

After this wrapper is removed, the next stage decrypts two AES-128-GCM blobs. One blob is a small Bun bootstrapper ... and the other is the main Shai-Hulud payload.

In GitHub Actions environments, it can use ACTIONS_ID_TOKEN_REQUEST_TOKEN and ACTIONS_ID_TOKEN_REQUEST_URL to request an OIDC token for npm:registry.npmjs.org, exchange it at the npm registry, and publish through the obtained identity.

The attack's malware, which its authors named Miasma, differed from the TeamPCP original only cosmetically ... while the underlying credential-stealing functionality remained intact.

The recent wave of supply chain attacks targeting packages, extensions, and CI pipelines, such as Shai-Hulud, Megalodon and Miasma, should be read less as isolated package integrity failures and more as credential-harvesting campaigns.

In GitHub Actions environments, it can use ACTIONS_ID_TOKEN_REQUEST_TOKEN and ACTIONS_ID_TOKEN_REQUEST_URL to request an OIDC token for npm:registry.npmjs.org, exchange it at the npm registry, and publish through the obtained identity.

The malware, written in Rust, harvests a wide range of developer secrets, including API keys, cloud credentials, SSH keys, and npm publishing tokens, and reuses them to spread further across the software supply chain.

Validate stolen credentials and enumerate accessible repositories, services, and permission levels.

Furthermore, the autonomous worm weaponizes these stolen keys to facilitate rapid lateral movement across interconnected development pipelines.

GitHub actually works as a malicious C2 server, but not just for uploading stolen data, but storing the malicious code as well... This turns GitHub into something more dangerous than a dead drop. It’s an adaptive C2

Rather than merely hosting exfiltrated data, the threat actor stores malicious code in GitHub repositories and uses commits tagged with the string “firedalazer” as a dynamic payload delivery mechanism.

The payload also retains the GitHub dead-drop model seen in previous Shai-Hulud waves.

While conventional npm malware operates with one to three execution stages, Shai-Hulud deploys a six-stage payload delivery chain that loops back on itself in an endless execution cycle.

The attack begins with an obfuscated index.js payload that proceeds through decryption and decoding stages and ultimately drops 15 distinct payloads including memory dump tools, token monitors, Claude API hooks, and a GitHub-based payload dropper.

The threat actor can dynamically change the “firedalazer” commits in GitHub, making new versions of the malware, more adaptive and more sophisticated.

Collect system, user, developer configuration, and CI/CD environment data. Search for GitHub access tokens, package registry authentication tokens, and cloud-related secrets.

The threat actor isn’t just uploading exfiltrated credentials to a GitHub repo — they’re storing the malicious code there, and using commits tagged with the “firedalazer” string as a live update mechanism.